net: sched: sch: Fix off by one in htb_activate_prios() in Kernel
Summary
GSD-2023-1002395: net: sched: sch: Fix off by one in htb_activate_prios(). Affects Kernel versions >= fbe71c5dacaa5a9960323215f118958174c81aa0, < 7519069f1fb8140a3994bc35ba46df83ccd9de5f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages system resources and provides an interface between hardware and software. It is responsible for tasks such as process management, memory management, and device drivers. The htb_activate_prios() function is part of the network scheduler (sched) subsystem in the Kernel, specifically the Hierarchical Token Bucket (HTB) queuing discipline. HTB is used for traffic shaping and bandwidth allocation in network devices. This vulnerability in htb_activate_prios() can potentially lead to a security issue.
Vulnerability Detail
The vulnerability in htb_activate_prios() is an off-by-one error, which occurs when the function incorrectly accesses an array or buffer by exceeding its bounds. This can result in memory corruption or information disclosure. An attacker may be able to exploit this vulnerability to gain elevated privileges, execute arbitrary code, or cause a denial-of-service condition. The vulnerability was introduced in version v5.4.232 of the Linux Kernel and has been fixed in version v5.4.232 by commit 7519069f1fb8140a3994bc35ba46df83ccd9de5f.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to apply the fix by updating the Linux Kernel.
Conclusion
The vulnerability in htb_activate_prios() in the Kernel can lead to potential security risks, including privilege escalation, code execution, or denial-of-service. It is crucial to update the Linux Kernel to version v5.4.232 or later to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can potentially allow an attacker to gain elevated privileges, execute arbitrary code, or cause a denial-of-service condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there is no known exploit publicly available for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if the affected system is accessible over a network. It is crucial to update the Linux Kernel to prevent any potential remote attacks.
In addition to updating the Linux Kernel, it is always recommended to follow best practices for system security, such as regularly applying security patches, using strong passwords, and implementing proper network security measures.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
